Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 291:

  DRAG DROP

  You have an Azure Sentinel deployment.

  You need to query for all suspicious credential access activities.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://davemccollough.com/2020/11/28/threat-hunting-with-azure-sentinel/

• Question 292:

  DRAG DROP

  Your company deploys Azure Sentinel.

  You plan to delegate the administration of Azure Sentinel to various groups.

  You need to delegate the following tasks:

  1.

  Create and run playbooks

  2.

  Create workbooks and analytic rules.

  The solution must use the principle of least privilege.

  Which role should you assign for each task? To answer, drag the appropriate roles to the correct tasks. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/roles

• Question 293:

  DRAG DROP

  You need to use an Azure Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-custom

• Question 294:

  DRAG DROP

  You are investigating an incident by using Microsoft 365 Defender.

  You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 295:

  DRAG DROP

  You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.

  You need to hide the alerts automatically in Security Center.

  Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://techcommunity.microsoft.com/t5/azure-security-center/suppression-rules-for-azure-security-center-alerts-are-now/ba-p/1404920

• Question 296:

  DRAG DROP

  You have an Azure subscription.

  You need to delegate permissions to meet the following requirements:

  1.

  Enable and disable Azure Defender.

  2.

  Apply security recommendations to resource.

  The solution must use the principle of least privilege.

  Which Azure Security Center role should you use for each requirement? To answer, drag the appropriate roles to the correct requirements. Each role may be used once, more than once, or not at all. You may need to drag the split bar

  between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/security-center/security-center-permissions

• Question 297:

  DRAG DROP

  You have the resources shown in the following table.

  

  You need to prevent duplicate events from occurring in SW1.

  What should you use for each action? To answer, drag the appropriate resources to the correct actions. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Using the same machine to forward both plain Syslog and CEF messages

  If you plan to use this log forwarder machine to forward Syslog messages as well as CEF, then in order to avoid the duplication of events to the Syslog and CommonSecurityLog tables:

  On each source machine that sends logs to the forwarder in CEF format, you must edit the Syslog configuration file to remove the facilities that are being used to send CEF messages. This way, the facilities that are sent in CEF won't also be

  sent in Syslog. See Configure Syslog on Linux agent for detailed instructions on how to do this.

  You must run the following command on those machines to disable the synchronization of the agent with the Syslog configuration in Microsoft Sentinel. This ensures that the configuration change you made in the previous step does not get

  overwritten.

  sudo su omsagent -c 'python /opt/microsoft/omsconfig/Scripts/OMS_MetaConfigHelper.py --disable'

• Question 298:

  DRAG DROP

  You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud.

  You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: From Logic App Designer, create a logic app. Create a logic app and define when it should automatically run

  1.

  From Defender for Cloud's sidebar, select Workflow automation.

  2.

  To define a new workflow, click Add workflow automation. The options pane for your new automation opens.

  

  Here you can enter:

  A name and description for the automation.

  The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated.

  The Logic App that will run when your trigger conditions are met.

  3.

  From the Actions section, select visit the Logic Apps page to begin the Logic App creation process.

  4.

  Etc.

  Step 2: From Logic App Designer, run a trigger.

  Manually trigger a Logic App

  You can also run Logic Apps manually when viewing any security alert or recommendation.

  Step 3: From Workflow automation in Defender for cloud, add a workflow automation. Configure workflow automation at scale using the supplied policies Automating your organization's monitoring and incident response processes can greatly improve the time it takes to investigate and mitigate security incidents.

  

• Question 299:

  DRAG DROP

  You have a Microsoft Sentinel workspace named workspace1 and an Azure virtual machine named VM1.

  You receive an alert for suspicious use of PowerShell on VM1.

  You need to investigate the incident, identify which event triggered the alert, and identify whether the following actions occurred on VM1 after the alert:

  1.

  The modification of local group memberships

  2.

  The purging of event logs

  Which three actions should you perform in sequence in the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: From the Investigation blade, select Insights

  The Investigation Insights Workbook is designed to assist in investigations of Microsoft Sentinel Incidents or individual IP/Account/Host/URL entities.

  Step 2: From the Investigation blade, select the entity that represents VM1.

  The Investigation Insights workbook is broken up into 2 main sections, Incident Insights and Entity Insights.

  Incident Insights

  The Incident Insights gives the analyst a view of ongoing Sentinel Incidents and allows for quick access to their associated metadata including alerts and entity information.

  Entity Insights

  The Entity Insights allows the analyst to take entity data either from an incident or through manual entry and explore related information about that entity. This workbook presently provides view of the following entity types:

  IP Address

  Account

  Host

  URL

  Step 3: From the details pane of the incident, select Investigate.

  Choose a single incident and click View full details or Investigate.

  Reference:

  https://github.com/Azure/Azure-Sentinel/wiki/Investigation-Insights---Overview

  https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases

• Question 300:

  DRAG DROP

  You have an Azure subscription linked to an Azure Active Directory (Azure AD) tenant. The tenant contains two users named User1 and User2.

  You plan to deploy Azure Defender.

  You need to enable User1 and User2 to perform tasks at the subscription level as shown in the following table.

  

  The solution must use the principle of least privilege.

  Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Owner

  Only the Owner can assign initiatives.

  Box 2: Contributor

  Only the Contributor or the Owner can apply security recommendations.

  Reference:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions